Cybersecurity compliance in Switzerland

The first step is to define the scope and identify the regulatory requirements that apply to your organisation. A structured cybersecurity compliance assessment should benchmark your controls against relevant frameworks and test governance, incident response, cyber resilience, supplier oversight, recovery capabilities and the evidence supporting those controls. This helps organisations understand gaps and prioritise remediation.

The most effective approach is to establish an integrated resilience programme covering governance, risk management, testing, incident management, supplier controls and evidence management. Preparing for DORA and comparable resilience-focused regulatory requirements requires clear ownership, effective controls, regular testing and up-to-date documentation that supports regulatory review and strengthens long-term cyber resilience.

FINMA requirements apply to the relevant Swiss financial institutions, while the EU frameworks apply to different organisations, services, products and activities depending on their respective scope. Swiss organisations may therefore need to address both Swiss and EU requirements depending on their legal structure, clients, technologies, products and market presence.

A SWIFT CSP assessment reviews compliance with the applicable mandatory security controls that underpin the annual SWIFT attestation. For the SIC system, the Swiss National Bank defines specific endpoint security requirements, including requirements relating to periodic independent assessment and attestation. The precise assessment and attestation requirements depend on the participant and applicable SIC requirements.

A control attestation report provides independent assurance over defined organisational, operational or technology controls. It may be required by a specific framework or contract, or used by ICT providers to demonstrate their control environment to regulated customers.